Today, many organizations make use of OneDrive.
OneDrive is a great solution for collaboration and storage.
Since it exists within the cloud and makes use of the
underlying infrastructure of Office 365 and Azure,
it is very difficult to block or detect if it's
being used for malicious activity.
With that being said,
Empire has a listener that you could create, leveraging OneDrive.
So let's go ahead and take a look at how we can set this
listener up and what the requirements are.
We begin by using the listener for OneDrive,
and as we scroll up and look at the record options,
there's a number of requirements that we need.
These are the AuthCode, Client ID, and ClientSecret.
To get these values, we need to create an application within Azure.
So navigate into the Azure portal and select in App
registrations, we need to register a new application.
You can provide any descriptive name that you like,
and under the Supported account types,
you can use the multitenant along with personal Microsoft accounts.
For the URI, this needs to be set to Web,
and you need to make use of the oauth2 URI.
Once you click on Register, the application will be created.
From here, we already have our first value, which is the Client ID.
This can now be populated into the OneDrive listener.
The next value that we require is a ClientSecret.
To obtain this,
we need to navigate to Certificates & secrets within the application,
click on New client secret, give it a descriptive name,
and you can also set the lifetime of the secret, and once you click on Add,
you will now have the secret.
We need to copy the value and populate this within Empire.
In order to obtain the AuthCode, we need to first execute the listener.
The reason for this is that the listener actually needs to authenticate to
OneDrive in order for the application to be registered.
Once you execute the listener, you will get a URL that you need to navigate to.
Once you navigate to the URL, you can approve the
permissions and then you will have your AuthCode.
The AuthCode is everything that exists between the
equals and the ampersand signs.
This value will need to be populated into your listener
configuration. Now that you've got all of the values,
you can execute the listener, and this will go ahead and actually start
the listener. Now that my listener has been created,
I can use it for C2 communication.
And just to confirm that the listener is in fact actually set up,
I can look at OneDrive and I will find a folder which correlates to
the name of my application, and within that folder I've got
subfolders that relate to the various activities that I can perform
within Empire, using this listener.